commit 3ea54ba890f25fcce9213d8ab7c7f8a9fdf10cad
author Corentin Wallez <cwallez@chromium.org> Thu Mar 17 17:26:58 2016 -0400
committer Corentin Wallez <cwallez@chromium.org> Tue Mar 22 21:07:02 2016 +0000
tree 21bc0eaa236cb9f9cef247a622d614870df2b435
parent 1a4523f3d27e523fd0388c3e208cc3f80e0aa2d3

Program::getUniformInternal: return only one array element

When getUniformInternal detected a mismatch between the glGetUniform
type and the uniform type, it entered a code path where it wrongly wrote
the whole array instead of a single element, causing a buffer overflow.

Adds a regression test.

BUG=595836

Change-Id: Id7372faece276d28363a30bf3183497d97357c76
Reviewed-on: https://chromium-review.googlesource.com/333771
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>

src/libANGLE/Program.cpp

diff --git a/src/libANGLE/Program.cpp b/src/libANGLE/Program.cpp
index bd16fd9..b4aa8dc 100644
--- a/src/libANGLE/Program.cpp
+++ b/src/libANGLE/Program.cpp
@@ -2508,7 +2508,7 @@
         return;
     }
 
-    int components = VariableComponentCount(uniform.type) * uniform.elementCount();
+    int components = VariableComponentCount(uniform.type);
 
     switch (componentType)
     {